Lecture #11 Digital Signatures

1. Lecture #11 Digital Signatures HAIT Summer 2005 Shimrit Tzur-David

2. Motivation • The authenticity of many documents is determined by the presence or absence of an authorized handwritten signature. • We would like to compute a message systems to replace the physical transport of paper and ink documents. • We need a system by which one party can send a signed message to another party in such a way that the following conditions hold: • The receiver can verify the claimed identity of the sender. • The sender cannot later repudiate the contents of the message. • The receiver cannot possibly have concocted the message himself.

3. Motivation – Cont. • The first requirement is needed, for example, since a bank has to authenticate the customer. • The second requirement is needed to protect the bank against fraud. Suppose that a costumer buys a ton of gold from the bank, and immediately thereafter the price of gold drops sharply. A dishonest customer might sue the bank, claiming that he never issued any order to buy gold. • The third requirement is needed to protect the customer in the event that the price of gold shoots up and the bank tries to construct a signed message in which the customer asked for one kilo of gold instead of one ton.

4. Symmetric-Key Signatures • One approach to digital signatures is to have a central authority that knows everything and whom everyone trusts, say Big Brother (BB). • Each user then chooses a secret key and carries it by hand to BB's office. • Thus, only Alice and BB know Alice's secret key, KA, and so on.

5. Scenario • Alice wants to send a signed plaintext message, P, to her banker, Bob: • she generates KA(B, RA, t, P), where B is Bob's identity, RA is a random number chosen by Alice, t is a timestamp to ensure freshness, and KA(B, RA, t, P) is the message encrypted with her key, KA. • BB sees that the message is from Alice, decrypts it, and sends a message to Bob. • The message to Bob contains the plaintext of Alice's message and also the signed message KBB (A, t, P). • Bob now carries out Alice's request.

6. Scenario – Cont.

7. Does it safe? • What happens if Alice later denies sending the message? • The judge will ask Bob how he can be sure that the disputed message came from Alice and not from Trudy. • Bob first points out that BB will not accept a message from Alice unless it is encrypted with KA, so there is no possibility of Trudy sending BB a false message from Alice without BB detecting it immediately. • Bob then produces KBB (A, t, P). Bob says that this is a message signed by BB which proves Alice sent P to Bob. • The judge then asks BB (whom everyone trusts) to decrypt KBB (A, t, P). When BB testifies that Bob is telling the truth, the judge decides in favor of Bob.

8. Symmetric-Key Drawback • A structural problem with using symmetric-key cryptography for digital signatures is that everyone has to agree to trust Big Brother. • Furthermore, Big Brother gets to read all signed messages. • It would be nice if signing documents did not require a trusted authority.

9. Public-Key Signatures • Let us assume that the public-key encryption and decryption algorithms have the property that E(D(P)) = P in addition to the usual property that D(E(P)) = P. (RSA has this property, so the assumption is not unreasonable.) • Alice can send a signed plaintext message, P, to Bob by transmitting EB(DA(P)). • Note that Alice knows her own (private) key, DA, and Bob's public key, EB.

10. Public-Key Signatures – Cont. • When Bob receives the message, he transforms it using his private key, as usual, yielding DA(P). • He stores this text in a safe place and then applies EA to get the original plaintext.

11. Does it safe? • Suppose that Alice subsequently denies having sent the message P to Bob. • Bob can produce both P and DA(P). The judge can easily verify that Bob indeed has a valid message encrypted by DA by simply applying EA to it. • Since Bob does not know what Alice's private key is, the only way Bob could have acquired a message encrypted by it, is if Alice did indeed send it.

12. Weak point 1 • Bob can prove that a message was sent by Alice only as long as DA remains secret. • If Alice discloses her secret key, the argument no longer holds, because anyone could have sent the message, including Bob himself. • Example: Bob is Alice's stockbroker. Alice tells Bob to buy a certain stock or bond. Immediately thereafter, the price drops sharply. To repudiate her message to Bob, Alice runs to the police claiming that her home was burglarized and the PC holding her key was stolen. She also claims not to have discovered the break-in until getting home from work, several hours later.

13. Weak point 2 • Alice decides to change her key. it is clearly legal, and it is probably a good idea to do so periodically. • If a court case later arises, as described above, the judge will apply the current EA to DA(P) and discover that it does not produce P. • Bob will look pretty stupid at this point.

14. Authentication and Secrecy • Signature methods couple two distinct functions: authentication and secrecy. • Do we need them both? • Often, authentication is needed but secrecy is not. • Also, getting an export license is often easier if the system in question provides only authentication but not secrecy. • We will describe an authentication scheme that does not require encrypting the entire message.

15. Message Digests • This scheme is based on the idea of a one-way hash function that takes an arbitrarily long piece of plaintext and computes a fixed-length bit string. • This hash function, MD, often called a message digest, has four important properties: • Given P, it is easy to compute MD(P). • Given MD(P), it is effectively impossible to find P. • Given P no one can find P' such that MD (P') = MD(P) • A change to the input of even 1 bit produces a very different output.

16. MD with Public Key • Alice first computes the message digest of her plaintext. • She then signs the message digest and sends both the signed digest and the plaintext to Bob. • If Trudy replaces P underway, Bob will see this when he computes MD(P) himself.

17. The Birthday Attack • How many students do you need in a class before the probability of having two people with the same birthday exceeds 1/2? • Do expect the answer to be way over 100? • In fact, probability theory says it is just 23. • Intuitively, with 23 people, we can form (23 x 22)/2 = 253 different pairs, each of which has a probability of 1/365 of being a hit.

18. Generalization • If there is some mapping between inputs and outputs with n inputs (people, messages, etc.) and k possible outputs (birthdays, message digests, etc.), there are n(n - 1)/2 input pairs. • If n(n - 1)/2 > k, the chance of having at least one match is pretty good. • Thus, approximately, a match is likely for n > sqr(k). • This result means that a 64-bit message digest can probably be broken by generating about 232 messages and looking for two with the same message digest.

19. Example • The Department of Computer Science at State University has one position for a faculty member and two candidates, Tom and John. Tom was hired two years before John, so he goes up for review first. • If he gets it, John is out of luck. • Tom knows that the department chairperson, Marilyn, thinks highly of his work, so he asks her to write him a letter of recommendation to the Dean, who will decide on Tom's case. • Once sent, all letters become confidential.

20. Example – Cont. • Marilyn tells her secretary, Ellen, to write the Dean a letter. • When it is ready, Marilyn will review it, compute and sign the 64-bit digest, and send it to the Dean. • Ellen can send the letter later by e-mail. • Unfortunately for Tom, Ellen is romantically involved with John, so she writes the letter below with the 32 bracketed options. • As soon as Ellen finishes composing and typing in the first letter, she also writes a second one.

21. The First Letter • Dear Dean Smith, • This [letter | message] is to give my [honest | frank] opinion of Prof. Tom Wilson, who is [a candidate | up] for tenure [now | this year]. I have [known | worked with] Prof. Wilson for [about | almost] six years. He is an [outstanding | excellent] researcher of great [talent | ability] known [worldwide | internationally] for his [brilliant | creative] insights into [many | a wide variety of] [difficult | challenging] problems. • He is also a [highly | greatly] [respected | admired] [teacher | educator]. His students give his [classes | courses] [rave | spectacular] reviews. He is [our | the Department's] [most popular | best-loved] [teacher | instructor]. • [In addition | Additionally] Prof. Wilson is a [gifted | effective] fund raiser. His [grants | contracts] have brought a [large | substantial] amount of money into [the | our] Department. [This money has | These funds have] [enabled | permitted] us to [pursue | carry out] many [special | important] programs, [such as | for example] your State 2000 program. Without these funds we would [be unable | not be able] to continue this program, which is so [important | essential] to both of us. I strongly urge you to grant him tenure.

22. The Second Letter • Dear Dean Smith, • This [letter | message] is to give my [honest | frank] opinion of Prof. Tom Wilson, who is [a candidate | up] for tenure [now | this year]. I have [known | worked with] Tom for [about | almost] six years. He is a [poor | weak] researcher not well known in his [field | area]. His research [hardly ever | rarely] shows [insight in | understanding of] the [key | major] problems of [the | our] day. • Furthermore, he is not a [respected | admired] [teacher | educator]. His students give his [classes | courses] [poor | bad ] reviews. He is [our | the Department's] least popular [teacher | instructor], known [mostly | primarily] within [the | our] Department for his [tendency | propensity] to [ridicule | embarrass] students [foolish | imprudent] enough to ask questions in his classes. • [In addition | Additionally] Tom is a [poor | marginal] fund raiser. His [grants | contracts] have brought only a [meager | insignificant] amount of money into [the | our] Department. Unless new [money is | funds are] quickly located, we may have to cancel some essential programs, such as your State 2000 program. Unfortunately, under these [conditions | circumstances] I cannot in good [conscience | faith] recommend him to you for [tenure | a permanent position].

23. The Scheme • Ellen programs her computer to compute the 232 message digests of each letter overnight. • She hope that one digest of the first letter will match one digest of the second letter. • If not, she can add a few more options and try again. • Suppose that she finds a match. Call the ''good'' letter A and the ''bad'' one B. • Ellen now e-mails letter A to Marilyn for her approval. • Letter B she keeps completely secret. • Marilyn approves, computes her 64-bit message digest, signs the digest, and e-mails the signed digest off to Dean Smith. • Ellen e-mails letter B to the Dean.

24. The Scheme – Cont. • The Dean gets the letter and signed message digest. • The Dean runs the message digest algorithm on letter B, sees that it agrees with what Marilyn sent him, and fires Tom. • The Dean does not realize that Ellen managed to generate two letters with the same message digest and sent him a different one than Marilyn saw and approved. • It would take over 500 years to compute all 264 digests of two letters with 64 variants each.